Multiple cross-site scripting (XSS) vulnerabilities in HTMLy 2.7.4 allow remote attackers to inject arbitrary web script or HTML via the (1) destination parameter to delete feature; the (2) destination parameter to edit feature; (3) content parameter in the profile feature.
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/151733/HTMLy-2.7.4-Cross-Site-Scripting.html | Exploit Third Party Advisory VDB Entry |
| http://seclists.org/fulldisclosure/2019/Feb/40 | Exploit Mailing List Third Party Advisory |
| https://www.netsparker.com/web-applications-advisories/ | Third Party Advisory |
| http://packetstormsecurity.com/files/151733/HTMLy-2.7.4-Cross-Site-Scripting.html | Exploit Third Party Advisory VDB Entry |
| http://seclists.org/fulldisclosure/2019/Feb/40 | Exploit Mailing List Third Party Advisory |
| https://www.netsparker.com/web-applications-advisories/ | Third Party Advisory |
Configurations
History
21 Nov 2024, 04:49
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://packetstormsecurity.com/files/151733/HTMLy-2.7.4-Cross-Site-Scripting.html - Exploit, Third Party Advisory, VDB Entry | |
| References | () http://seclists.org/fulldisclosure/2019/Feb/40 - Exploit, Mailing List, Third Party Advisory | |
| References | () https://www.netsparker.com/web-applications-advisories/ - Third Party Advisory |
Information
Published : 2019-05-08 14:29
Updated : 2024-11-21 04:49
NVD link : CVE-2019-8349
Mitre link : CVE-2019-8349
CVE.ORG link : CVE-2019-8349
JSON object : View
Products Affected
htmly
- htmly
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')